Catch stray Retains() and Releases() outside of RetainPtr<>.

core/fxcrt/cfx_retain_ptr.h

Index: core/fxcrt/cfx_retain_ptr.h
diff --git a/core/fxcrt/cfx_retain_ptr.h b/core/fxcrt/cfx_retain_ptr.h
index 8c7bf289a7142ab6bd3eba2605e339d66b75bf46..bff1b9691cd2d15913ee318df3310366e87efafe 100644
--- a/core/fxcrt/cfx_retain_ptr.h
+++ b/core/fxcrt/cfx_retain_ptr.h
@@ -60,15 +60,24 @@ class CFX_RetainPtr {
 // Trivial implementation - internal ref count with virtual destructor.
 class CFX_Retainable {
  public:
+  bool HasOneRef() const { return m_nRefCount == 1; }
+
+ protected:
+  virtual ~CFX_Retainable() {}
+
+ private:
+  template <typename U>
+  friend struct ReleaseDeleter;
+
+  template <typename U>
+  friend class CFX_RetainPtr;
+
   void Retain() { ++m_nRefCount; }
   void Release() {
     if (--m_nRefCount == 0)
       delete this;
   }
-  bool HasOneRef() const { return m_nRefCount == 1; }
 
- protected:
-  virtual ~CFX_Retainable() {}
   intptr_t m_nRefCount = 0;
 };
 
@@ -76,6 +85,8 @@ namespace pdfium {
 
 // Helper to make a CFX_RetainPtr along the lines of std::make_unique<>(),
 // or pdfium::MakeUnique<>(). Arguments are forwarded to T's constructor.
+// Classes managed by CFX_RetainPtr should have protected (or private)
+// constructors, and should friend this function.
 template <typename T, typename... Args>
 CFX_RetainPtr<T> MakeRetain(Args&&... args) {
   return CFX_RetainPtr<T>(new T(std::forward<Args>(args)...));